request.getUserPrincipal() is still not null after session is invalidated

java, principal, session-timeout, websphere

Solution

I have found solution in sphere documentation.

- In the administrative console, click Security > Global security.

- Under Custom properties, click New.

- In the Name field, enter com.ibm.ws.security.web.logoutOnHTTPSessionExpire.

- In the Values field, enter true.

- Click Apply and Save to save the changes to your configuration.

- Resynchronize and restart the server.

Problem

I have web application deployed on websphere application server 7.0. User logins using /j_security_check. When session timeout occures session ivnvalidates but request.getUserPrincipal() is still not null. I expect it should be null. How to clean user principal?

Original source